SOC 2 Maturity · Security of Data and IT Services
Your SOC 2 controls mapped by theme and turned into a costed action plan.
10 themes, 129 questions, a 5-level scale. And the action that moves each level to the next.
The framework’s 10 themes, already written from L1 to L5. One company, one business unit, or 300 at once.
SOC 2 Maturity · Security of Data and IT Services
10 themes, 129 questions, 5-level scale.
Nordhavn Industries
53 / 100
They measure their maturity with Datamensio
An example
This could be your situation.
Take one company as an example: three sites, three spreadsheets, no shared answer.
Nobody can consolidate.
Nordhavn Industries, 2,400 people in Hamburg, Lyon and Porto. A client asks where the group stands. Each site answers in its own spreadsheet, with its own scales.
Three weeks, a single base.
One SOC 2, AICPA Trust Services Criteria (2017 edition, 2022 revision) assessment launched across all three sites at once, from the managers’ interview notes. The framework was already written, its 10 themes and levels L1 to L5 too.
Two costs avoided before being committed.
A score of 53 out of 100, with the gap concentrated on three themes. The AI companion spotted that two actions duplicated those of another audit. The committee report took one sentence to request.
What it saved them
- 3sites measured on the same base, instead of three questionnaires to reconcile
- 2duplicate actions caught before the spend
- 1committee report, with no manual rework
These figures are an example. They could be yours.
The standard imposes processes. Datamensio says where you stand.
01
The framework is already written
Themes, questions and levels L1 to L5, all written. You do not start from an empty spreadsheet.
02
The score lands the same day
Online, by self-assessment link or in interview. Theme by theme, comparable over time.
03
The gap becomes a costed plan
Every step up carries its action. The AI prioritises on expected effect, not on the order of the standard.
04
Progress can be demonstrated
Campaign after campaign, against your target and against your own past. That is what your board asks for.
The maturity scale
One level, the next, and the action that links the two.
It is this mechanism (one level, the level above, and the action linking the two) that turns a finding into a trajectory.
Are access reviews on systems within scope carried out and tracked?
- N1
No access review is organised. Existing accounts have not been reassessed since creation.
- N2
Reviews happen, at some teams’ initiative, with no defined frequency and no reusable record.
- N3
A periodic review is defined and applied on the main systems, with a dated report and an identified owner.
- N4
The review covers the entire scope, access removals are tracked through to execution and gaps are followed up to closure.
- N5
Detected gaps feed back into the revision of access allocation rules, with removal turnaround indicators and a review of the approach itself.
Action to move from L2 to L3
Set a quarterly frequency per system, designate a business approver for each application and anchor the review to the existing security committee, with a dated access export kept as evidence.
« With Datamensio, we meet our objectives far more efficiently. The ERDF inspection services and our supervising ministry particularly appreciated an approach that gives them reliable data. »
Director, CCI 94CCI Île-de-France
« We believe this is the most suitable solution to scale our transformation project and measure impact according to our needs. »
Maja SucekChief Operating Officer, Interreg Danube
Rarely on its own
Frameworks combine. Put several together to cover your business, or have the AI write yours.
Take your first measurementon SOC 2.
What this framework covers
SOC 2 is an attestation framework defined by the AICPA for organisations that process data on behalf of their clients. It rests on the Trust Services Criteria: security, which is mandatory, then availability, processing integrity, confidentiality and privacy, selected according to the commitments made. The common criteria cover the control environment, communication, risk management, control activities, logical and physical access management, operations, change management and risk mitigation. A type I report describes the design of controls at a given date, a type II report their actual operation over an observation period.
In practice, the difficulty is not describing the controls but demonstrating that they operated without interruption throughout the period. Did the quarterly access reviews actually happen, with a usable record, or were they reconstructed just before the audit? Do changes deployed under emergency follow the same approval path as any other? Are critical suppliers subject to a documented review, or to a contract signed once and never revisited? These are the answers that determine what the report says, not the quality of the written policy.
A common confusion needs clearing up: SOC 2 is not a certification and does not map one for one against ISO 27001. SOC 2 produces an attestation report written by an independent firm, covering the controls the organisation itself defined to meet its service commitments. There is therefore wide latitude on scope and on how controls are worded, which shifts the real challenge to the internal consistency of the whole set-up. Organisations already engaged with ISO 27001 can reuse much of their existing base, provided they rebuild the evidence logic over time.
The maturity assessment answers a different question from the audit. The audit concludes with an exception or the absence of one on a given control. The assessment places each practice on a progressive scale and points to the action that moves it up a level: what remains merely stated, what is applied but untracked, what is systematic and measured. This is what lets you decide where to invest effort before the observation period rather than finding out during it.
Within Datamensio, the framework is ready to use and adaptable. The AI adjusts themes, questions and levels according to the scope of criteria selected, or builds a variant from your own policies and control descriptions.
Reference standard: SOC 2, AICPA Trust Services Criteria (2017 edition, 2022 revision)
The themes assessed
Control environment and governance
Management commitment, roles and responsibilities, independence of control functions, reference policies, team competencies.
Communication and information
Internal distribution of policies, formalised service commitments to clients, reporting channels, supplier information.
Risk assessment
Identification of risks to service commitments, consideration of fraud and change, mapping of systems and data flows.
Monitoring of controls
Second line controls, periodic reviews, tracking of exceptions and remediation plans through to closure.
Logical and physical access management
Account lifecycle, authentication and privileges, access reviews, administrator access, access to premises and production environments.
Operations and monitoring
Incident detection, response procedure, logging, vulnerability management, tested backups and restores.
Change management
Approval path, environment segregation, testing, rollback procedures, handling of emergency changes.
Availability and continuity
Service level commitments, capacity, redundancy, continuity and recovery plan, documented exercises.
Confidentiality and data protection
Classification, encryption at rest and in transit, retention periods, deletion at end of contract, handling of personal data.
Third party and subcontracting chain management
Selection of critical suppliers, security clauses, review of attestation reports received, monitoring of second tier subcontractors.
A short version of the framework, with 40 questions, is available for the online self-assessment. The full version covers 10 themes and 129 questions.
Frequently asked questions
Is SOC 2 a certification?
No. SOC 2 results in an attestation report issued by an independent firm on the controls you have defined. Datamensio measures the maturity of those controls and prepares the firm’s fieldwork, it does not issue any attestation report.
What is the difference between this assessment and the SOC 2 audit?
The audit rules control by control and reports exceptions. The assessment places each practice on a maturity scale and points to the action that moves it up a level. One validates, the other tells you where to invest before the observation period.
Do we need to choose between type I and type II before starting the assessment?
No. The assessment covers both design and operation of controls, which actually informs that choice. The highest levels concern regularity and traceability over time, which is exactly what a type II report examines.
How long does the assessment take?
The short version takes 20 to 30 minutes to complete. The full version, run collaboratively, typically spans one to two weeks: most of the time goes into gathering input from technical teams and application owners.
Can the framework be adapted to our scope?
Yes. You choose which criteria to include, edit questions and levels, and add your own themes. The AI can also generate a variant from your existing control descriptions. You retain full ownership of the framework.
How does SOC 2 fit alongside an existing ISO 27001?
A large part of the base is shared, notably access, change and third party management. The cross framework roadmap consolidates both assessments and avoids duplicating actions, distinguishing what belongs to the management system from what belongs to evidence over the period.
Can several entities be compared with each other?
Yes. The same framework applies across several business units or platforms, with benchmarking between entities and against previous assessments. This is useful when the report scope covers several product teams.
Where is the data hosted?
In France, with OVH, backed up with Scaleway. No transfer outside the European Union. The AI models used can be selected, including from European providers.